Password generator

Password generator is a free tool that creates random passwords with a chosen length and optional numbers, symbols, lowercase letters, and uppercase letters.

Where does this generator process my request?

The generator processes the request on the server. Your selected settings travel to the server over HTTPS and are not stored. Generation does not happen entirely within your browser, so a claim that the data never leaves your device would be incorrect.

The implementation calls PHP's random_int function, which is intended for cryptographically secure random integer generation. HTTPS protects the request while it travels between your browser and the server, but it does not address risks on your own device, such as clipboard history, screen recording, or monitoring software.

Avoid using the tool on a shared or untrusted computer. After generation, save the result directly in a password manager rather than leaving it in a notes file, email draft, chat message, or document.

Does password length matter more than special-character tricks?

Yes, additional random characters generally contribute more strength than predictable substitutions such as replacing an "a" with "@" or an "o" with "0." Attackers account for common substitutions, keyboard patterns, dates, names, and familiar endings such as "123!" when trying password guesses.

Crack-time estimates describe how long a guessing attack might take under specific assumptions. The actual time varies with the account system, password hashing method, available computing resources, and whether the attack is online or against stolen password hashes. Online services can slow repeated guesses with rate limits or temporary lockouts, while an attacker with stolen hashes may be able to test guesses much faster.

There is no single length that every website accepts. Use a long random password within the service's stated limit. This tool accepts a requested length up to 2,048 characters, although ordinary login forms commonly have much lower limits and may reject extremely long values.

Why is password reuse dangerous?

Password reuse is dangerous because one compromised site can expose credentials that attackers try on other services. This practice is commonly called credential stuffing. A password can be long and difficult to guess yet still become unsafe for every account where it was reused.

Generate a different password for each login and store it in a password manager. A manager can associate each password with the correct website and fill it without requiring you to memorize the random characters. An unencrypted plain-text notes file does not provide the purpose-built encryption of a reputable password manager.

Prioritize unique passwords for your primary email account, password manager, banking logins, cloud storage, and any account that can reset other accounts. Multifactor authentication adds another barrier, but it does not make password reuse a good practice.

Choosing settings for the account

Match the settings to the website's password rules, then favor length over making the result unnecessarily difficult to enter. The controls determine the requested number of characters and which character categories are available during generation.

1. Set Characters to a length accepted by the destination website.
2. Enable Include lowercase characters and Include UPPERCASE characters when the site permits both.
3. Use Include numbers when numbers are accepted or required.
4. Use Include symbols when symbols are accepted. Some older systems permit only a limited selection of punctuation.

For example, choosing 24 characters with all four categories enabled requests a 24-character result drawn using lowercase letters, uppercase letters, numbers, and symbols. Choosing 18 characters with symbols disabled requests an 18-character result using the other enabled categories. The exact password cannot be predicted because its characters are selected randomly.

Do not assume that enabling a category necessarily guarantees that every generated result contains at least one character from it. The available implementation details do not establish such a guarantee. If a site requires at least one uppercase letter, number, or symbol, inspect the result before submitting it and generate another if needed.

The listed settings do not define the exact symbol alphabet or state that spaces, accented letters, or non-Latin characters are included. If a service has narrow rules, check the generated value against those rules. At least one character category must be available for a usable password to be constructed.

Are passphrases secure enough for account logins?

Yes, a sufficiently long passphrase made from unrelated, randomly selected words can be a legitimate alternative when you need to type and remember the secret. Its strength depends on the number of independently selected words and the size and distribution of the word list, not on writing a familiar quotation or personal sentence.

A passphrase such as several randomly chosen words is useful for a password manager's master password or another login you must type regularly. Do not build one from a song lyric, address, pet name, or predictable phrase. Adding a year to a common expression does little to resist targeted guessing.

This generator's listed controls work with character categories rather than a word-list mode. Use character-based random passwords for credentials that a password manager will store and fill. If you create a passphrase separately, use a method that selects words randomly and confirm that the website permits its length and any spaces or separators.

Frequently asked questions

Can I use a generated password as an API key?

Only when the system explicitly lets you define the secret yourself. Many API keys are issued by the service and may include identifiers, prefixes, permissions, or validation data. Do not replace a service-issued key with a generated password unless its documentation supports custom secrets.

Is it safe to leave the password in clipboard history?

Clipboard history can retain copied passwords and may synchronize them between devices, depending on operating system settings. Paste the result directly into the account form and password manager, then remove temporary clipboard entries where your device provides that option. Avoid copying the password into chat or email for storage.

Should I generate a password on a shared computer?

It is safer to use a device you control. The fact that your selected settings are not stored on the server does not prevent a shared computer from recording keystrokes, screenshots, browser activity, or clipboard contents. If you have no alternative, change the password later from a trusted device.

Final checks

• Confirm that the website accepted the password before closing the page.
• Verify that your password manager saved the exact value and associated it with the correct domain.
• Enable multifactor authentication when the account supports it.
• Store recovery codes separately from the device used for routine sign-ins.
• Delete temporary copies from notes, documents, messages, and clipboard history.